T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:353
- Finding
- Sensitive credentials and OAuth tokens exposed in URL query strings<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 353–400 **Vulnerability Type**: Sensitive data exposure through URL query parameters **Risk Level**: Medium ### Complete Code Snippet ```python # Backend: exchange code for session def qq_miniapp_login(code): url = ( 'https://api.q.qq.com/sns/jscode2session' f'?appid={QQ_APPID}&secret={QQ_SECRET}&js_code={code}' '&grant_type=authorization_code' ) resp = requests.get(url).json() return resp # {"openid": "...", "session_key": "..."} ``` ```python # Exchange authorization code for access token def get_qq_access_token(code: str) -> dict: url = ( "https://graph.qq.com/oauth2.0/token" f"?grant_type=authorization_code&client_id={APP_ID}" f"&client_secret={APP_SECRET}&code={code}&redirect_uri={REDIRECT_URI}" "&fmt=json" ) return requests.get(url).json() # {"access_token": "...", "expires_in": 7776000, "refresh_token": "..."} # Obtain openid def get_openid(access_token: str) -> str: url = f"https://graph.qq.com/oauth2.0/me?access_token={access_token}&fmt=json" data = requests.get(url).json() return data["openid"] # Obtain user information def get_user_info(access_token: str, openid: str) -> dict: url = ( "https://graph.qq.com/user/get_user_info" f"?access_token={access_token}&oauth_consumer_key={APP_ID}&openid={openid}" ) return requests.get(url).json() ``` ### Technical Analysis The examples place an application secret, OAuth authorization code, and access tokens directly in URL query strings. Although the destinations are legitimate QQ HTTPS endpoints and these requests support the Skill's declared authentication functionality, query parameters are commonly recorded as part of the complete URL. Sensitive values may consequently appear in: - Application and reverse-proxy access logs - HTTP client debug logs - APM and distributed-tracing systems - Exception messag ...[truncated 1608 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use an HTTP authorization header or POST request body for secrets and tokens whenever the QQ endpoint supports those mechanisms. 2. If an endpoint requires query parameters, configure all application, proxy, APM, and HTTP client logging to redact: - `secret` - `client_secret` - `code` - `access_token` - `session_key` 3. Avoid manually interpolating credentials into URL strings. Use the HTTP client's parameter handling and a centralized redaction layer. 4. Prevent complete request URLs from being included in exceptions, tracing spans, analytics, or user-facing errors. 5. Restrict access to operational logs, minimize their retention period, and encrypt them at rest. 6. Store application secrets in a managed secret store or protected environment variable rather than source code or client-side configuration. 7. Rotate any credential known or suspected to have appeared in logs. 8. Add an explicit warning to the Skill explaining that these provider-defined query parameters are sensitive and must never be logged. ]]>